CVE-2014-9015

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-24 · updated 2026-06-17
Weakness: CWE-264

Description

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

Affected products

Debian Linux: 7.0
Drupal: from 6.0 before 6.34; from 7.0 before 7.34 — fixed in 6.34, 7.34

How to fix

Upgrade to a fixed version: Drupal 6.34, 7.34. Check the vendor advisory for mitigations.

References

http://secunia.com/advisories/59164
http://secunia.com/advisories/59814
http://www.debian.org/security/2014/dsa-3075
http://www.openwall.com/lists/oss-security/2014/11/20/21
http://www.openwall.com/lists/oss-security/2014/11/20/3
https://www.drupal.org/SA-CORE-2014-006
http://secunia.com/advisories/59164
http://secunia.com/advisories/59814
http://www.debian.org/security/2014/dsa-3075
http://www.openwall.com/lists/oss-security/2014/11/20/21
http://www.openwall.com/lists/oss-security/2014/11/20/3
https://www.drupal.org/SA-CORE-2014-006

Get alerted when CVE-2014-9015 or the next vulnerability affects your stack